Example #1
0
        private void HookGame()
        {
            Process game = Process.GetProcessesByName("Talos").FirstOrDefault();

            if (game == null)
            {
                game = Process.GetProcessesByName("Talos_Unrestricted").FirstOrDefault();
                if (game == null)
                {
                    throw new InjectionFailedException("Could not find game process to inject into!");
                }
            }

            MemManager manager = new MemManager(game);

            if (!manager.IsHooked)
            {
                throw new InjectionFailedException("Could not find game process to inject into!");
            }

            // TODO: Proper way of selecting addresses
            if (manager.Is64Bit)
            {
                injection = new TextInjection64(manager, new AddressList_440_64(manager));
            }
            else
            {
                injection = new TextInjection32(manager, new AddressList_244_32(manager));
            }
        }
        public MemoryGraph(MemVisualizer.MainWindow mainViewerWindow, MemManager.Log.Log log)
        {
            //
            // Required for Windows Form Designer support
            //
            InitializeComponent();
            mGraphVScrollBar.Enabled = false;
            mGraphHScrollBar.Enabled = false;
            mTextComp1.Text = mTextComp2.Text = "";
            mComparePressed = mCompareProcessed = false;
            //
            // TODO: Add any constructor code after InitializeComponent call
            //

            mMainViewWindow = mainViewerWindow;

            mLog = log;

            CreateMemoryGraph(log);

            mHighlightIndexStart = null;
            mHighlightIndexEnd = null;

            for (int i = 1; i <= 10; ++i)
            {
                mZoomComboControl.Items.Add("Zoom " + i.ToString() + "x");
            }
            mZoomComboControl.SelectedIndex = 0;
        }
Example #3
0
 public void SetLog(MemManager.Log.Log lg)
 {
     if (mLog != lg)
     {
         mLog = lg;
         mDirty = true;
     }
 }
Example #4
0
        public ATextInjection(MemManager manager, IAddressList addr)
        {
            this.manager = manager;
            this.addr    = addr;

            if (!addr.FoundAddresses)
            {
                throw new InjectionFailedException("Could not find locations to inject into! Most likely you are not running a compatible game version.");
            }
        }
Example #5
0
        public Form1()
        {
            InitializeComponent();
            newFileName  = "";
            newPathName  = "";
            openFileName = "";


            MemManager.ResumeFat();
            //ResumeFat();
            ResumeDictionary();
        }
Example #6
0
        public MainWindow()
        {
            InitializeComponent();

            _unlimitedManager = new HackManager(cwUnlimited);
            _mem = new MemManager(Process.GetProcesses().FirstOrDefault(m => m.ProcessName.Contains("ASAMU")));

            _unlimitedManager.ActivationAction = () =>
            {
                var address = _mem.EvaluateOffsets(0x0270AB1C, 0x4, 0x28, 0x3d0);
                _mem.WriteInt32(address, 0);
            };
        }
Example #7
0
 private void buttonGetC_Click(object sender, EventArgs e)
 {
     DetermineLeaderPositionPointers();
     if (ProcessIsAttached)
     {
         numericUpDown27.Value = (decimal)MemManager.ReadFloat(Pointer0X);
         numericUpDown28.Value = (decimal)MemManager.ReadFloat(Pointer0Y);
         numericUpDown29.Value = (decimal)MemManager.ReadFloat(Pointer0Z);
     }
     else
     {
         MessageBox.Show("Error reading data", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
     }
 }
Example #8
0
 private void buttonTeleportToTrigger_Click(object sender, EventArgs e)
 {
     DetermineLeaderPositionPointers();
     if (ProcessIsAttached)
     {
         MemManager.Write4bytes(Pointer0X, BitConverter.GetBytes((float)numericUpDown6.Value));
         MemManager.Write4bytes(Pointer0Y, BitConverter.GetBytes((float)numericUpDown7.Value));
         MemManager.Write4bytes(Pointer0Z, BitConverter.GetBytes((float)numericUpDown8.Value));
     }
     else
     {
         MessageBox.Show("Error writing data", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
     }
 }
        //-------------------------------------------------------------------
        public void Index(MemManager.Log.Log lg)
        {
            /*
            System.Collections.Hashtable cache = new System.Collections.Hashtable(4096);
            int processed = 0;

            System.Text.StringBuilder addresses = new System.Text.StringBuilder();
            addresses.EnsureCapacity(32768);

            // Work out all unique addresses
            for (int i = 0; i < lg.Count; i++)
            {
                int index = lg[i].stackTraceString;
                if (index <= processed)
                    continue;

                processed = index;
                string callstack = lg.GetString(index);
                string[] addrarray = callstack.Split(' ');
                foreach (string s in addrarray)
                {
                    if (!cache.ContainsKey(s))
                    {
                        cache[s] = s;
                        addresses.Append(s);
                        addresses.Append(' ');

                        // Fix issue with nasty command line length issue on win32.
                        if (addresses.Length >= 32000)
                        {
                            Index(addresses.ToString());

                            // Wipe addresses
                            addresses = new System.Text.StringBuilder();
                            addresses.EnsureCapacity(32768);
                        }
                    }
                }
            }

            // Index unique addresses
            if (addresses.Length > 0)
                Index(addresses.ToString());
            */
        }
Example #10
0
        public AddressList_440_64(MemManager manager)
        {
            FoundAddresses = false;
            ProcessModule exe = manager.HookedProcess.MainModule;

            InjectLocation = manager.SigScan(exe.BaseAddress, exe.ModuleMemorySize, 8,
                                             "49 8B CE",          // mov rcx, r14
                                             "E8 ????????",       // call Talos.exe + 69C50

                                                                  // jmp 13FFF0000
                                             "??????????????",    // OR
                                                                  // mov rcx,[r14 + 10]
                                                                  // test rcx, rcx

                                             "0F84 ????????",     // je Talos.exe + 688CC
                                             "83 3D ???????? 00", // cmp dword ptr [Talos.exe + 1E015B8], 00
                                             "0F84 ????????"      // je Talos.exe + 688CC
                                             );
            if (InjectLocation == IntPtr.Zero)
            {
                return;
            }
            InjectInstructionLength = 7;

            IntPtr tmp = manager.SigScan(exe.BaseAddress, exe.ModuleMemorySize, 15,
                                         "F3 0F11 4C 24 44",     // movss[rsp + 44], xmm1
                                         "C7 44 24 48 00000000", // mov[rsp + 48], 00000000
                                         "E8 ????????",          // call Talos.exe + A4AD80
                                         "48 8D 4C 24 50"        // lea rcx,[rsp+50]
                                         );

            if (tmp == IntPtr.Zero)
            {
                return;
            }
            DrawText = manager.ReadDisplacement(tmp, false);

            tmp = manager.SigScan(exe.BaseAddress, exe.ModuleMemorySize, 1,
                                  "E8 ????????",          // call Talos.exe + A47C60
                                  "48 8B 94 24 88000000", // mov rdx, [rsp + 00000088]
                                  "48 8B 0D ????????"     // mov rcx, [Talos.exe + 1E44500]
                                  );
            if (tmp == IntPtr.Zero)
            {
                return;
            }
            DrawBox  = manager.ReadDisplacement(tmp, false);
            Viewport = manager.ReadDisplacement(IntPtr.Add(tmp, 15), false);

            tmp = manager.SigScan(exe.BaseAddress, exe.ModuleMemorySize, 7,
                                  "85 C0",              // test eax, eax
                                  "74 4A",              // je Talos.exe + 688B8
                                  "48 8D 0D ????????",  // lea rcx, [Talos.exe + 1E017C0]
                                  "E8 ????????",        // call Talos.exe + A1AE80
                                  "F3 0F10 05 ????????" // movss xmm0, [Talos.exe + 12EDAA8]
                                  );
            if (tmp == IntPtr.Zero)
            {
                return;
            }
            Font    = manager.ReadDisplacement(tmp, false);
            SetFont = manager.ReadDisplacement(IntPtr.Add(tmp, 5), false);

            FoundAddresses = true;
        }
Example #11
0
        public static void TryHookGame()
        {
            foreach (Process p in Process.GetProcessesByName("SeriousSam"))
            {
                Manager = new MemManager(p);

                Engine = Manager.HookedProcess.Modules.Cast <ProcessModule>().Where(m => m.ModuleName == "Engine.dll").FirstOrDefault();
                if (Engine == null)
                {
                    continue;
                }

                CurrentVersion = CheckGameVersion();
                if (CurrentVersion != GameVersion.NONE)
                {
                    break;
                }
            }

            if (CurrentVersion == GameVersion.NONE)
            {
                return;
            }

            IntPtr _pNetwork = Manager.Read <IntPtr>(Manager.Read <IntPtr>(Manager.SigScan(
                                                                               Engine.BaseAddress,
                                                                               Engine.ModuleMemorySize,
                                                                               2,
                                                                               "8B 0D ????????", // mov ecx,[Engine._pNetwork]
                                                                               "83 C4 08",       // add esp,08
                                                                               "E8 ????????",    // call Engine.CNetworkLibrary::IsPaused
                                                                               "85 C0"           // test eax,eax
                                                                               )));

            if (_pNetwork == IntPtr.Zero)
            {
                CurrentVersion = GameVersion.NONE;
                return;
            }

            if (CurrentVersion == GameVersion.REVOLUTION)
            {
                difficultyPtr = new Pointer(_pNetwork, 0x9C);
                currentIGTPtr = new Pointer(_pNetwork, 0x20, 0x58);
                levelNamePtr  = new Pointer(_pNetwork, 0x12EC, 0x0);
            }
            else
            {
                difficultyPtr = new Pointer(_pNetwork, 0x988);
                currentIGTPtr = new Pointer(_pNetwork, 0x20, 0x38);
                levelNamePtr  = new Pointer(_pNetwork, (CurrentVersion == GameVersion.TFE)
                                              ? 0x1284
                                              : 0x1288, 0x0);
            }

            int     playerCount = Manager.Read <Int32>(new Pointer(_pNetwork, 0x20, 0x0));
            Pointer firstPlayer = new Pointer(_pNetwork, 0x20, 0x4, 0x0);

            AllPlayers = new Player[playerCount];
            for (int i = 0; i < playerCount; i++)
            {
                AllPlayers[i] = new Player(firstPlayer);
                firstPlayer   = firstPlayer.Adjust(PLAYER_TARGET_SIZE);
            }
        }
		//-------------------------------------------------------------------
		void PopulateDB( MemManager.Log.Log log )
		{
            DataSet myDataSet = new DataSet("DataSet");
			DataTable table;
			DataColumn column;
			DataGridColumnStyle columnstyle;
			string cats = "1Index|";
            if (mCategoryMode)
                cats += "0Category|";
            else
                cats += "0Heap|";

        //    cats+= "0Name|1Alignment|1ActualSize|1Count|1TotalSize";
            cats += "0Name|1ActualSize|1Count|1TotalSize";

			DataGridTableStyle tableStyle = new DataGridTableStyle(); 
			tableStyle.MappingName = "All"; 
			tableStyle.RowHeaderWidth = 10; 
			tableStyle.AlternatingBackColor = System.Drawing.Color.FromArgb(((System.Byte)(250)), ((System.Byte)(250)), ((System.Byte)(250)));

			table = new DataTable( "All" );
			table.BeginLoadData();
			foreach (string s in cats.Split('|'))
			{
				string n = s.Substring(1);

                //if (n == "Index")
                //    continue;
				column = new DataColumn();
				column.ColumnName = n;
				column.ReadOnly = true;
				column.Unique = false;				
				if (s[0] == '0')
				{
					column.DataType = System.Type.GetType("System.String");
					columnstyle = new DataGridTextBoxColumn();
				}
				else if (s[0] == '1')
				{
					column.DataType = System.Type.GetType("System.Int32");
					columnstyle = new DataGridTextBoxColumn();
				}
				else //if (s[0] == '2')
				{
					column.DataType = System.Type.GetType("System.Boolean");
					columnstyle = new DataGridBoolColumn();
				}
				table.Columns.Add(column);
				
				columnstyle.MappingName = n;
				columnstyle.HeaderText = n;
				columnstyle.Width = 70;
                if (n == "Name")
                    columnstyle.Width = 360;
                else if (n == "Heap")
                    columnstyle.Width = 70;
                else if (n == "Category")
                    columnstyle.Width = 90;
                else if (n == "Count" ) //|| n == "Alignment")
                    columnstyle.Width = 42;
				tableStyle.GridColumnStyles.Add( columnstyle );
			}

            for (int j = 0; j < mCollapsedView.Count; j++)
			{
                Item item = (Item)mCollapsedView[j];
                MemManager.Log.LogEntry le_a = log[item.index];

                string allocatorName = log.GetAllocator(le_a.allocator);
                string categoryName = mCategoryMode ? log.GetCategory(le_a.category) : log.GetCategory(0);

				DataRow row = table.NewRow();
				row["Index"] = item.index;
                if (mCategoryMode)
                    row["Category"] = categoryName;
                else
                    row["Heap"] = allocatorName;

             //   string removalString = log.GetAllocator(item.allocator) + "::";

             //   if (mCategoryMode)
              //      removalString += categoryName + "::";

                row["Name"] = log.GetString(le_a.nameString); //.Substring(removalString.Length);
           //     row["Alignment"] = item.alignment;
		//		row["ReqSize"] = item.requestedSize;
                row["ActualSize"] = le_a.allocSize;
				row["Count"] = item.count;
                row["TotalSize"] = item.count * le_a.allocSize;

                table.Rows.Add(row);
			}
			table.EndLoadData();

			// Add the table to the dataset
			myDataSet.Tables.Add(table);

			// Make the dataGrid use our new table style and bind it to our table 
			mDataGrid.TableStyles.Clear();
			mDataGrid.TableStyles.Add(tableStyle); 

			// Set up grid bindings
			mDataGrid.SetDataBinding(myDataSet, "All");

			// Update status
			UpdateStatusBar();
		}
		//-------------------------------------------------------------------
		void PopulateFromSnapshot(
			MemManager.Log.Log log,
			MemManager.Log.SnapShot snap,
			string filter,
            int size,
            bool dir
			)
		{
			// Make copy of view, ready to sort and collapse
            ArrayList view = new ArrayList(snap.Count);
			if (filter == "")
			{
				for (int i = 0, e = snap.Count; i < e; i++)
				{
					int logindex = snap[i];
					MemManager.Log.LogEntry le = log[ logindex ];
                    System.Diagnostics.Debug.Assert(le.type == 'A', "Error! All entries in snapshot should be allocations!");
                    if (le.index != (uint)logindex)
                        System.Diagnostics.Debug.Print("Something wrong with indexing");
					view.Add( le );
				}
			}
			else
			{
				Regex r = new Regex(filter, RegexOptions.Compiled|RegexOptions.IgnoreCase);
				for (int i = 0, e = snap.Count; i < e; i++)
				{
					int logindex = snap[i];
					MemManager.Log.LogEntry le = log[ logindex ];
                    //   le.index = (uint)logindex;
                    string name = mLog.GetString(le.nameString);
                    if (r.IsMatch(name))
                    {
                        if (size == 0)
                            view.Add(le);
                        else if (dir == false && le.allocSize >= size)
                            view.Add(le);
                        else if (dir == true && le.allocSize <= size)
                            view.Add(le);
                    }
                }
			}

            view.TrimToSize();

			// Sort view by category, size, and name-string
			view.Sort(new CompareCategorySizeAndName());

			// Create collapsed view
            mCollapsedView = new ArrayList(view.Count / 2);
			if (view.Count > 0)
			{
				MemManager.Log.LogEntry lastE = new MemManager.Log.LogEntry();
				lastE.category = 127;
                view.Add( lastE );	// append extra last object to make end logic easier!

				MemManager.Log.LogEntry last = (MemManager.Log.LogEntry)view[0];
				int count = 1;
				for (int i = 1, e = view.Count; i < e; i++)
				{
					MemManager.Log.LogEntry le = (MemManager.Log.LogEntry)view[i];
					if (last.category == le.category
						&& last.allocSize == le.allocSize
						&& last.nameString == le.nameString
				//		&& last.alignment == le.alignment
                 //	    &&	last.reqSize == le.reqSize)
                   )
					{
						count++;
					}
					else
					{
						Item it;

						it.count = count;
                        it.index = (int)last.index;

                        mCollapsedView.Add(it);
						last = le;
						count = 1;
					}
				}
			}

            mCollapsedView.TrimToSize();
            mCollapsedView.Sort(new CollapsedViewSort());
			PopulateDB(log);
		}
		//--------------------------------------------------------------------------
		//  This functions populates the snap shot of the current allocations
		public void PopulateGVStructFromSnapshot (MemManager.Log.Log log, MemManager.Log.SnapShot snap, int catfilter)
		{
            mMemoryBlockIndex.Clear();
            for (int i = 0, e = snap.Count; i < e; i++)
            {
                int logindex = snap[i];
                MemManager.Log.LogEntry le = log[logindex];
                if (le.category == catfilter || catfilter == 0)
                {
                    mMemoryBlockIndex.Add(snap[i]);
                }
            }
            mMemoryBlockIndex.Sort();
        }
        private void CreateMemoryGraph(MemManager.Log.Log log)
        {
            mRunningSumArray = new int[log.Count];
            int[] categoryrunningSum = null;
            if (mCategoryEnabled)
            {
                mNumberOfCategories = log.GetNumberCategories() - 1;  // ignore first category which is basically no category
                mCatSelectionBox.Items.Add("All");
                for (int i = 0; i < mNumberOfCategories; i++)
                    mCatSelectionBox.Items.Add(log.GetCategory((byte)(i + 1)));
                mCatSelectionBox.SelectedIndex = 0;

                mCategoryRunningSumArrays = new ArrayList[mNumberOfCategories];
                categoryrunningSum = new int[mNumberOfCategories];
                for (int i = 0; i < mNumberOfCategories; i++)
                {
                    mCategoryRunningSumArrays[i] = new ArrayList(log.Count);
                    categoryrunningSum[i] = 0;
                }
            }
            else
            {
                if (mNumberOfCategories > 0)
                {
                    for (int i = 0; i < mNumberOfCategories; i++)
                    {
                        mCategoryRunningSumArrays[i].Clear();
                        int gen = System.GC.GetGeneration(mCategoryRunningSumArrays[i]);
                        System.GC.Collect(gen);
                        mCategoryRunningSumArrays[i] = null;
                    }

                    mCategoryRunningSumArrays = null;
                }
                mNumberOfCategories = -1;
            }

            mUnflilteredRunningSumArrays = new int[log.Count];
            mLabelsArray = new ArrayList();
            mFramesArray = new ArrayList();

            mMaxMemoryAllocation = 0;
            mMinMemoryAllocation = 0;
            int runningSum = 0;
            int unfilteredRunningSum = 0;
            Regex regex = new Regex(mFilterTextBox.Text, RegexOptions.Compiled|RegexOptions.IgnoreCase);

            bool DoFiltering = (mFilterTextBox.Text != "");
            for (int i = 0; i < log.Count; i++)
            {
                MemManager.Log.LogEntry logentry = log[i];

                bool filtered = DoFiltering && !(regex.IsMatch(log.GetString(logentry.nameString)));

                if (!filtered)
                {
                    if (logentry.type == 'A')
                    {
                        runningSum += (int)logentry.allocSize;
                    }
                    else if (logentry.type == 'F')
                    {
                        runningSum -= (int)logentry.allocSize;
                    }
                }
                if (logentry.type == 'A')
                {
                    unfilteredRunningSum += (int)logentry.allocSize;
                    if (mCategoryEnabled)
                        categoryrunningSum[logentry.category - 1] += (int)logentry.allocSize;
                }
                else if (logentry.type == 'F')
                {
                    unfilteredRunningSum -= (int)logentry.allocSize;
                    if (mCategoryEnabled)
                        categoryrunningSum[logentry.category - 1] -= (int)logentry.allocSize;
                }
                else if (logentry.type == 'S')
                {
                    mFramesArray.Add(i);
                }
                else if (logentry.type == 'L')
                    mLabelsArray.Add(i);

                mRunningSumArray[i] = runningSum;
                mUnflilteredRunningSumArrays[i] = unfilteredRunningSum;
                for (int k = 0; k < mNumberOfCategories; k++)
                    mCategoryRunningSumArrays[k].Add(categoryrunningSum[k]);

                mMaxMemoryAllocation = Math.Max(mMaxMemoryAllocation, unfilteredRunningSum);
                mMinMemoryAllocation = Math.Min(unfilteredRunningSum, mMinMemoryAllocation);
            }
            mFramesArray.Add(log.Count);

            int maxMem = 1;
            while (maxMem < mMaxMemoryAllocation)
            {
                maxMem *= 2;
            }
            mMaxMemoryAllocation = maxMem;

            int minMem = 1;
            while (-minMem > mMinMemoryAllocation)
            {
                minMem *= 2;
            }
            mMinMemoryAllocation = minMem == 1 ? 0 : minMem;

            GenerateGraphicalData();
        }
Example #16
0
 public TextInjection32(MemManager manager, IAddressList addr) : base(manager, addr)
 {
 }
        public AddressList_244_32(MemManager manager)
        {
            FoundAddresses = false;
            ProcessModule exe = manager.HookedProcess.MainModule;

            InjectLocation = manager.SigScan(exe.BaseAddress, exe.ModuleMemorySize, 5,
                                             "E8 ????????",      // call Talos.exe + 63C640

                                                                 // jmp 017F0000
                                             "??????????",       // OR
                                                                 // mov ecx,[esi+08]
                                                                 // test ecx, ecx

                                             "0F84 ????????",    // je Talos.exe + 641B8E
                                             "E8 ????????",      // call Talos.exe + 867970
                                             "85 C0",            // test eax, eax
                                             "0F84 ????????",    // je Talos.exe + 641AEC
                                             "83 3D ???????? 00" // cmp dword ptr[Talos.exe + 118860C], 00

                                             );
            if (InjectLocation == IntPtr.Zero)
            {
                return;
            }
            InjectInstructionLength = 5;

            IntPtr tmp = manager.SigScan(exe.BaseAddress, exe.ModuleMemorySize, 6,
                                         "F3 0F11 45 CC", // movss[ebp - 34], xmm0
                                         "E8 ????????",   // call Talos.exe + 83A330
                                         "83 C4 14"       // add esp, 14
                                         );

            if (tmp == IntPtr.Zero)
            {
                return;
            }
            DrawText = manager.ReadDisplacement(tmp, false);

            tmp = manager.SigScan(exe.BaseAddress, exe.ModuleMemorySize, 1,
                                  "E8 ????????",    // call Talos.exe + 82FE20
                                  "8B 4D FC",       // mov ecx,[ebp - 04]
                                  "8B 15 ????????", // mov edx,[Talos.exe + 11E8A20]
                                  "0F57 C0",        // xorps xmm0, xmm0
                                  "83 C4 18"        // add esp, 18
                                  );
            if (tmp == IntPtr.Zero)
            {
                return;
            }
            DrawBox  = manager.ReadDisplacement(tmp, false);
            Viewport = manager.Read <IntPtr>(IntPtr.Add(tmp, 9));

            tmp = manager.SigScan(exe.BaseAddress, exe.ModuleMemorySize, 8,
                                  "83 C4 1C",    // add esp,1C
                                  "85 C0",       // test eax, eax
                                  "74 ??",       // je Talos.exe + 641B7E
                                  "68 ????????", // push Talos.exe + 11D6B60
                                  "E8 ????????"  // call Talos.exe + 81F230
                                  );
            if (tmp == IntPtr.Zero)
            {
                return;
            }
            Font    = manager.Read <IntPtr>(tmp);
            SetFont = manager.ReadDisplacement(IntPtr.Add(tmp, 5), false);

            FoundAddresses = true;
        }